This tutorial shows the steps to install an Ubuntu 15.10 (Wiley Werewolf) server with Nginx, PHP, MariaDB, Postfix, pure-ftpd, BIND, Dovecot and ISPConfig 3. ISPConfig 3 is a web hosting control panel that allows you to configure the installed services through a web browser. This setup provides a full hosting server with web, email (inc. spam and antivirus filter), Database, FTP and DNS services.

1. Preliminary Note

In this tutorial, I will use the hostname server1.example.com with the IP address 192.168.1.100 and the gateway 192.168.1.1 for the network configuration. These settings might differ for you, so you have to replace them where appropriate. Before proceeding further, you need to have a basic minimal installation of Ubuntu 15.10 as explained in tutorial.

The steps in this tutorial have to be executed as root user, so I will not prepend "sudo" in front of the commands. Either Login as root user to your server before you proceed or run:

sudo su

to become root when you are logged in as a different user on the shell.

The commands to edit files will use the editor "nano", you can replace it with an editor of your choice. Nano is an easy to use file editor for the shell. If you like to use nano and haven't installed it yet, run:

apt-get install nano

2. Update Your Linux Installation

Edit /etc/apt/sources.list. Comment out or remove the installation CD from the file and make sure that the universe and multiverse repositories are enabled. It should look like this:

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to# newer versions of the distribution.deb http://de.archive.ubuntu.com/ubuntu/ wily main restricteddeb-src http://de.archive.ubuntu.com/ubuntu/ wily main restricted

## Major bug fix updates produced after the final release of the## distribution.deb http://de.archive.ubuntu.com/ubuntu/ wily-updates main restricteddeb-src http://de.archive.ubuntu.com/ubuntu/ wily-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu## team, and may not be under a free licence. Please satisfy yourself as to## your rights to use the software. Also, please note that software in## multiverse WILL NOT receive any review or updates from the Ubuntu## security team.deb http://de.archive.ubuntu.com/ubuntu/ wily multiversedeb-src http://de.archive.ubuntu.com/ubuntu/ wily multiversedeb http://de.archive.ubuntu.com/ubuntu/ wily-updates multiversedeb-src http://de.archive.ubuntu.com/ubuntu/ wily-updates multiverse

## N.B. software from this repository may not have been tested as## extensively as that contained in the main release, although it includes## newer versions of some applications which may provide useful features.## Also, please note that software in backports WILL NOT receive any review## or updates from the Ubuntu security team.deb http://de.archive.ubuntu.com/ubuntu/ wily-backports main restricted universe multiversedeb-src http://de.archive.ubuntu.com/ubuntu/ wily-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's## 'partner' repository.## This software is not part of Ubuntu, but is offered by Canonical and the## respective vendors as a service to Ubuntu users.# deb http://archive.canonical.com/ubuntu wily partner# deb-src http://archive.canonical.com/ubuntu wily partner

Then run:

apt-get update

To update the apt package database and then:

apt-get upgrade

to install the latest updates (if there are any). If you see that a new kernel gets installed as part of the updates, you should reboot the system afterward:

reboot

3. Change the Default Shell

/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash. Therefore we do this:

dpkg-reconfigure dash

Use dash as the default system shell (/bin/sh)?<-- No

If you don't do this, the ISPConfig installation will fail.

4. Disable AppArmor

AppArmor is a security extension (similar to SELinux) that should provide extended security. It is not installed by default from onwards 13.10. We will cross check if it is installed. In my opinion you don't need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn't working as expected, and then you find out that everything was ok, only AppArmor was causing the problem). Therefore, I disable it (this is a must if you want to install ISPConfig later on).

MariaDB is a fork of the MySQL database server, developed by the original MySQL developer Monty Widenius. According to tests found on the internet, MariaDB is faster than MySQL and it's development is going on with more pace, therefore, most Linux Distributions replaced MySQL with MariaDB as default "MySQL alike" database server. In case that you prefer MySQL over MariaDB, replace "mariadb-client mariadb-server" in the above command with "mysql-client mysql-server".

We want MariaDB/MySQL to listen on all interfaces, not just localhost. Therefore we edit /etc/mysql/mariadb.conf.d/mysqld.cnf (for MariaDB or/etc/mysql/my.cnf (for MySQL) and comment out the line bind-address = 127.0.0.1:

MariaDB

nano /etc/mysql/mariadb.conf.d/mysqld.cnf

[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address = 127.0.0.1
[...]

Then we restart MariaDB:

service mysql restart

The systemd service name for MariaDB and MySQL is "mysql", so the restart command is the same for both database servers.

The default shell for Linux systems has been /bin/sh for many years, ubuntu decided to switch to /bin/dash now but dash is not 100% compatible with sh, so shell scripts especially some configure scripts to compile software fail with dash. For ispconfig, the shell does not matter at all. But when you start to try to compile software like jailkit as we will do in this tutorial then this can fail with dash. Using /bin/sh as default shell has no negative effects.

This tutorial uses the latest Nginx version that is available from Ubuntu as it is meant as a stable production server system and not as a testbed for latest dev versions of a software. If you want to install a newer third party package, then you can do that of course. Just ensure that your custom compiled Nginx uses the exact same compile options then the one from Ubuntu (e.g. the same folders and the same user and group www-data).